CVE-2026-100361

Awaiting Analysis Awaiting Analysis - Queue

SuiteCRM Authentication Bypass via Mass Assignment

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-100361

EUVD

EUVD-2026-117719

Affected Vendors & Products

Vendor	Product	Version / Range
SuiteCRM	SuiteCRM	< 7.15.2
SuiteCRM	SuiteCRM	>= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have a mass assignment vulnerability in the V8 REST API. Authenticated users can modify sensitive fields marked as hidden (api-visible: false and sensitive: true) via PATCH requests to /Api/V8/module. This allows changing authentication-related fields like user_hash or external_auth_only, bypassing intended security controls.

Detection Guidance

To detect this vulnerability, check SuiteCRM versions for 7.15.1 or earlier and 8.10.1 or earlier. Review API logs for PATCH requests to /Api/V8/module that modify fields like user_hash or external_auth_only. Look for unauthorized changes to authentication-related attributes in user accounts.

Impact Analysis

An attacker with access could modify authentication flags, change password hashes, or alter external-authentication settings. This could lead to unauthorized account access, bypass of authentication workflows, or persistence of malicious access even after credentials are changed.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems. For GDPR, it may lead to unauthorized processing of personal data. For HIPAA, it could enable unauthorized access to protected health information.

Mitigation Strategies

Immediately upgrade SuiteCRM to versions 7.15.2 or 8.10.2 or later. Review and audit user accounts for unauthorized modifications to authentication fields. Restrict API access to trusted users and monitor for suspicious PATCH requests to /Api/V8/module.

Hi! I’m here to help you understand CVE-2026-100361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...